CVE-2026-90550 in AVideo
Summary
by MITRE • 09/12/2026
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to check user authorization in the PlayerSkins mediaSession.json.php endpoint before returning video metadata. Unauthenticated attackers can request the endpoint with a video ID parameter to retrieve password-protected video titles and owner email addresses without authentication.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/12/2026
The vulnerability identified in WWBN AVideo, specifically within the PlayerSkins mediaSession.json.php endpoint, represents a critical failure in access control mechanisms that allows unauthenticated actors to bypass security restrictions intended for private content. This flaw stems from insufficient authorization checks during the processing of requests aimed at retrieving video metadata. In typical web application architectures, endpoints handling sensitive data or administrative functions must verify that the requesting user possesses valid credentials and appropriate permissions before disclosing information. However, in this instance, the server processes requests containing a video ID parameter without validating whether the requester is authorized to view the associated content. This architectural oversight effectively neutralizes authentication controls for specific metadata retrieval operations, creating a significant security gap that can be exploited remotely by any internet user with network access to the vulnerable application.
The technical nature of this flaw aligns closely with CWE-284, which describes Improper Access Control, and more specifically reflects aspects of CWE-306 regarding Missing Authentication for Critical Function. By failing to enforce authentication requirements on the mediaSession.json.php endpoint, the system inadvertently exposes sensitive metadata associated with password-protected videos. Attackers can construct simple HTTP requests specifying a target video ID, prompting the server to return detailed information including the video title and the email address of the content owner. This behavior indicates that while the actual video stream might remain protected by passwords or other access controls, the ancillary data surrounding the media file is treated as public knowledge regardless of its privacy settings. Such exposure violates fundamental principles of confidentiality and integrity, allowing adversaries to gather intelligence about private user accounts without needing valid login credentials.
From an operational perspective, this vulnerability poses substantial risks related to information disclosure and potential social engineering attacks. The leakage of owner email addresses provides attackers with a direct vector for phishing campaigns or targeted harassment against content creators who may not expect their personal contact information to be publicly accessible via API endpoints. Furthermore, the ability to enumerate video titles allows adversaries to map out the structure of private repositories within the platform. This reconnaissance capability can facilitate further attacks by identifying high-value targets or sensitive topics discussed in password-protected videos. The ease of exploitation means that automated tools could rapidly scan for vulnerable instances and harvest large volumes of personal data, leading to widespread privacy violations and potential regulatory non-compliance under frameworks such as GDPR or CCPA due to the unauthorized exposure of personally identifiable information.
Mitigation strategies must focus on enforcing strict access control policies at both the application logic level and through defensive infrastructure measures. Developers should immediately patch the vulnerability by ensuring that all requests to sensitive endpoints, including mediaSession.json.php, require valid authentication tokens or session cookies before processing any parameters. Implementing role-based access control checks is essential to guarantee that only authorized users can retrieve metadata for private content. Additionally, adopting a principle of least privilege ensures that API endpoints expose only the minimum necessary data required for their function. For immediate risk reduction while patches are deployed, organizations should configure web application firewalls to monitor and block requests targeting this specific endpoint with suspicious patterns indicative of enumeration attacks. Regular security audits and static code analysis focused on authorization logic can help prevent similar oversights in future development cycles, ensuring robust protection against unauthenticated data access vulnerabilities.